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REMARKS 



This Preliminary Amendment cancels the original claims, without prejudice, 
in the underlying PCT Application No. PCT/DE2004/000285. The Preliminary Amendment also 
adds new claims 1 1-20. The new claims conform the claims to U.S. Patent and Trademark 
Office rules and do not add new matter to the application. 

In accordance with 37 C.F.R. § 1.125(b), the Substitute Specification (including 
the Abstract) contains no new matter. The amendments reflected in the Substitute Specification 
(including Abstract) are to conform the Specification and Abstract to United States Patent and 
Trademark Office rules or to correct informalities. As required by 37 C.F.R. §§ 1.121(b)(3)(ii) 
and 1.125(c), a Marked-Up Version of the Substitute Specification comparing the Specification 
of record and the Substitute Specification also accompanies this Preliminary Amendment. 
Approval and entry of the Substitute Specification (including Abstract) are respectfully 
requested. 

The underlying PCT Application No. PCT/DE2004/000285 includes an 
International Search Report, dated August 2, 2004, a copy of which is submitted herewith. 

Applicant asserts that the subject matter of the present application is new, non- 
obvious, and useful. Prompt consideration and allowance of the application are respectfully 
requested. 

Respectfully submitted, 
KENYON & KENYON 



Dated: l°ln)or By: 

Gerard A. Messina 
(Reg. No. 35,952) 

One Broadway 

New York, NY 10004 

(212) 425-7200 
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METHOD FOR MONITORING THE PERFORMANCE RELIABILITY 
OF A CONTROL UNIT AND DIAGNOSTIC DEVICE 

R e lated Ar t Field Of The Invention 

The present invention relates to a method for monitoring the performance reliability of a 
control unit and/or at least one sensor of a safety device for the protection of vehicle occupants, 
as well as a diagnostic device. 

Background In formation 

Safety devices for the protection of vehicle occupants such as front and side airbags, rollover 
bars, belt tighteners etc., are standard equipment in motor vehicles manufactured these days. 
Typically, such safety devices are made up of a multitude of sensors for detecting a crash by 
recording a crash-related negative acceleration or velocity, and a control unit for the safety 
device, which analyzes a value derived from the crash. If a specific threshold value, which 
points to the presence of a crash, is detected, the control unit triggers the corresponding 
restraining means. 

As is often the case in electronic devices, there is the risk in control units and/or in sensors as 
well that they will not function or will not function properly, Which, however, must be avoided 
1 5 under all circumstances when safety devices are involved. Modern safety devices for the 

protection of vehicle occupants therefore include devices for checking the correct functioning 
of the sensors and/or the control unit, thereby detecting a malfunction as early as possible. 

For the most reliable operation of a safety device in a motor vehicle it is of crucial importance 
that the crash sensors (such as acceleration sensors, deformation sensors) and the 
20 corresponding control unit operate without faults at all times. If the performance reliability of a 
crash sensor or a control unit is interrupted, this must be signaled immediately so that the 
required repair and exchange may be initiated. 

Safety-relevant electronic devices to which the life of vehicle occupants is entrusted in a 
dangerous situation, must have extraordinary performance reliability. In most cases such high 
25 performance reliability can be guaranteed only if all components of the safety device are able to 
be checked with respect to their functioning. 
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In the method for checking an acceleration sensor of the safety device, a test signal is applied to 
the particular acceleration sensor whose proper functioning is to be tested. The answer signal 
transmitted by the acceleration sensor in response to the test signal will then be utilized as a 
measure for ascertaining the functioning of the acceleration sensor. These function tests of the 
5 acceleration sensor are carried out continuously during normal operation of the safety device, 
for instance when starting the vehicle. 

As far as the general background of the test for correct functioning of acceleration sensors is 
concerned, reference is made to the laid-open documents DE 44 39 886 Al, DE 37 06 765 Al, 
DE 37 36 291 Al, DE 1 3 02 399 Al, DE German Published Parent Application No. 44 39 886, 
10 German Published Patent Application No. 37 06 765, German Published Patent Application 
No. 3736294, German Published Patent Application No. 43 02 399, German Published Patent 
Application No. 197 57 1 1 8-A4- as well as the German patent document DEGerman Patent No. 
32 49 367C1. 367. 

In control units for safety devices for the protection of vehicle occupants and their remote 
15 sensors there is also always the risk that they get damaged in a crash. This type of damage 

depends mostly on the severity of the impact. If the impact, and thus the deformation, is severe 
enough to deform the location at which the control unit or the appropriate sensors is affixed, the 
impact may have damaged the control unit and/or the sensors as well. Such damage may be so 
severe that the control unit or the sensors are no longer operable. In this case these devices 
20 would have to be exchanged. Despite an impact and a resulting deformation it is entirely 

possible, however, that the control unit and individual sensors are still working properly, so 
that there is no need to replace them. Furthermore, it is possible that the control device or the 
sensors have indeed been damaged slightly by the impact, but in the beginning are still fully 
functional nevertheless. However, there is the risk in this case that these devices lose their 
25 functionality over the course of time, for instance due to mechanical influences such as 

vibrations, temperature or the entry of moisture, or stop functioning in another accident. In this 
case these devices should have been exchanged after the original impact. 

However, it is very difficult to distinguish the mentioned scenarios from each other. In 
particular in the case of a still operative devices it is not easy without further measures to 
30 determine whether and when this unit will possibly malfunction. 
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In control units for safety devices, in particular in the case of airbag control units, these are 
therefore exchanged, typically after one to five crashes during which the control unit has 
triggered at least one restraining means. In the case of crash sensors, there are often no 
regulations whether and, if so, under what circumstances these should be exchanged in the 
5 event of a crash. 

A related problem also arises from the fact that, especially in service facilities with less 
experienced staff, all control units and crash sensors are often exchanged because of a crash 
although some of them are still working perfectly. As an alternative, there is also the possibility 
that, for instance, a fully functioning control unit is exchanged, whereas an acceleration sensor, 
10 for example, which no longer provides full operability, is not replaced. 

Summary e £& eOfThe Invention 

Th e pr e s e nt inv e ntion solv es th e problems of th e r e lat e d art by a m e thod having th e f e atur e s of 
Claim 1, and a diagnostic d e vic e having th e f e atur e s of Claim 7. 

1 5 The principle on which the present invention is based is that the control unit or a comparable 
device decides on its own whether the control unit should be exchanged in the aftermath of a 
crash. In addition or as an alternative, the control unit or a comparable device may also decide 
whether and, if so, which sensors should be exchanged in the event of a crash. This minimizes 
the repair costs resulting from a crash since only control units or sensors that are not fully 

20 functional are replaced, whereas the operative devices may continue to be used. This also 
minimizes the risk of a control unit or a sensor failing in a crash. 

An additional advantage of the method according to the present invention is that this 
functionality must be described in the corresponding manuals and system specifications of the 
vehicle manufacturer, the service facility testing devices and vehicle manuals, which leads to 
25 high transparency and ensures excellent verifiability of the method. 

Advantag e ous e mbodim e nts and further r e fin e m e nts of th e pr e s e nt m e thod ar e m e ntion e d in 
th e subclaims and in th e specification with r e f e renc e to th e drawing. 

In one very advantageous embodiment a value for the impact severity is calculated not only for 
each control unit but for each sensor as well, this value being calculated in a device-specific 
30 manner. The individually calculated value for the impact severity of the control unit or sensor 
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in question wilt then be compared to a predefined threshold value. As a rule this threshold value 
is also predefined specifically for the individual control unit or the individual sensor. This 
means that, depending on the location of the individual control unit or the sensor inside the 
motor vehicle, and depending on its mechanical properties, a threshold value adapted thereto 
5 may be predefined in each case. Furthermore, the threshold value naturally may also depend on 
other parameters such as the mechanical stability of the particular device. 

In a further advantageous refinement, information from several preceding impacts is also able 
to be taken into consideration when determining the value for the impact severity of the control 
unit. In particular, this functionality provides, for instance, that preceding impacts in which the 

10 control unit has triggered will be taken into account as well when determining the impact 

severity of a new impact. As a result, a detected renewed impact may be assigned a relatively 
higher value for the impact severity than an equally heavy impact which was not preceded by 
an earlier impact, this being accomplished by scaling with a correction factor, for instance. As 
an alternative, it is also conceivable that the predefined threshold value is lowered in a repeat 

1 5 impact. In an advantageous manner, this refinement according to the present invention thus 

takes the possibility into account that the control unit has sustained damage in an earlier impact 
already. 

In another advantageous embodiment, the absolute value of the predefined threshold value is 
lowered with increasing operating time of the safety device. This takes the fact into 
20 consideration that, with increasing operating time, the control unit or the sensors no longer 
work as well compared to their original state, for instance, even without impact and thus 
without resulting damage, due to external influences, such as vibrations, temperature 
influences, improper handling etc. 

One advantageous refinement uses measurements from crash tests and calculations and 
25 findings derived therefrom to determine the predefined threshold value. Vehicle manufacturers 
are able to define for each model variant how high the predefined threshold should be selected 
as a function of the particular velocity, vehicle impact, impact type etc. For instance, prior to 
the initial operation of a safety device in a motor vehicle, a multitude of crash tests must be 
carried out to test this safety device. Such crash tests then yield empirical values or other 
30 findings for the predefined threshold at which the corresponding sensors and control units do 
stay operative after a crash, but it turns out ultimately that the performance reliability can no 
longer be ensured in long-term testing. 
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In an advantageous refinement, a testing device of a service center reads out and analyzes the 
output function-error signal. In addition or as an alternative, this may also be done by the 
control unit itself. 

In the latter case the diagnostic device will require an output unit, which informs the vehicle 
5 user of an occurring error signal. This output unit may be realized in the form of a blinking light, 
for instance. Furthermore, it may of course also be provided in the functionality of an onboard 
computer installed in the motor vehicle. In an advantageous refinement it is possible to infer 
from the error signal which control unit or which sensor is no longer fully functioning. 

In a very advantageous embodiment, the functionality of the diagnostic device may be 
10 implemented in the control unit itself, either entirely or at least partially. In the event that the 
measured or calculated value for the impact severity exceeds the predefined threshold value, 
the diagnostic device emits a function-error signal either to a service station testing device or to 
a program-controlled unit. In an advantageous manner a control-unit-typical or sensor-typical 
threshold value is provided for this control unit or for each sensor. This predefined threshold 
15 value is lower than a threshold value specified for the triggering of a restraining means. 

Brief Description &&& eOfThe Drawings 

Th e pr e s e nt inv e ntion is explained in greater detail in th e following with reference to the 
e xemplary e mbodim e nts s hown in the drawings. 

The figur e s s how: 

20 Figure l-The shows a block diagram of a safety device in a motor vehicle having the diagnostic 
device according to the present inventions 

Figure 2 Th e shows a sequence of a method according to the present invention, on the basis of 
a block diagrams 

25 

Figure 3-The shows a block diagram of a second embodiment of a diagnostic device according 
to the present invention. 

Detailed Description of th e Ex e mplary Embodim e nts 
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Unless specifically mentioned otherwise, identical or functionally equivalent elements have 
been provided with matching reference numerals in the figures of the drawing. 

Figure 1 shows the block diagram of a safety device having the diagnostic device according to 
the present invention. 

5 Reference numeral 1 in Figure 1 denotes the safety device. Here, safety device 1 is embodied as 
electronic restraining means, such as an airbag system. The safety device includes an airbag 
control unit 2 as well as a multitude of sensors 3 to 5. In the case at hand, safety device 1 has 
one or more front sensors 3 and side sensors 4, 5 although it is also possible to provide rear 
sensors as well. The present invention includes a diagnostic device 6. Diagnostic device 6 
10 communicates bidirectionally, both with control unit 2 and sensors 3 to 5. Instead of a single 
diagnostic device 6 it would also be conceivable, of course, to provide each control unit 2 or 
each sensor 3 to 5 with its own diagnostic device 6. It would likewise be possible to implement 
the functionality of diagnostic device 6 into control unit 2. 

Diagnostic device 6 according to the present invention includes a comparator 7 as well as an 
15 output unit 8. 

In the following, the method according to the present invention is described in greater detail on 
the basis of the block diagram in Figure 2. 

A vehicle impact typically produces an acceleration (or velocity or pressure) in the x- and 
y-direction. Should a vehicle impact occur, these accelerations are detected by at least one of 
20 sensors 3 to 5. These accelerations in the x-direction and y-direction are each integrated into a 
velocity (degraded vehicle velocity DV), and a mean value is generated therefrom. This 
so-called degraded velocity DV or its mean value usually is used as measure for the impact 
severity. 

The installed and remote sensors 3 through 5 thus supply control unit 2 with information 
25 regarding their mechanical loading (pressure or acceleration) as a result of a vehicle impact. 
During the vehicle impact, control unit 2 ascertains the respective integral and peak values of 
the measured signals. The data thus obtained are compared to adjustable thresholds, which 
ultimately leads to a triggering of a restraining means. 
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Furthermore, atcording to the present invention the degraded vehicle velocity, which is 
calculated from the maximum of the calculated x, y integrals of the measured acceleration, is 
utilized as a measure of the crash severity. These values for the crash severity are stored, for 
instance in a maximum amount memory. Following a vehicle impact, the content of the 
5 maximum-amount memory may be compared to a threshold specified by the vehicle 

manufacturer, which was determined in crash tests, for instance, which are conducted anyway. 
This comparison is implemented in comparator 7. If the predefined threshold is exceeded, 
control unit 2 or diagnostic device 6 will generate an error signal, which is indicated to the 
vehicle user in the form of a warning light 8, for example. In addition or as an alternative, this 
10 error- function signal may also be read out in a service facility by a service-facility testing 

device. Therefore, if a function-error signal is output, this indicates that airbag control unit 2 
and/or the respective sensors 3 to 5 must be exchanged. If the maximum amount remains below 
the predefined threshold, and if control unit 2 or sensors 3 to 5 exhibit no faults in an internal 
self-test, the individual device may remain in the vehicle since it is considered fully functional. 

15 In this way vehicle manufacturers are able to define a threshold (such as DV = 30 km/h) at 

which control unit 2 should be replaced. Either in addition or as an alternative, each individual 
external sensor 3 to 5 may be tested using similar calculations, either in addition or as an 
alternative. Airbag control unit 2 may therefore decide for itself and for each remote sensor 3 
through 5 whether a replacement is warranted after a vehicle impact. 

20 Although the present invention has been described above on the basis of the aforementioned 
preferred exemplary embodiment, it is not limited thereto, but may be modified in various 
ways. 

For instance, as illustrated in the exemplary embodiment in Figure 3, diagnostic device 6 
according to the present invention may also be implemented in control unit 2. Furthermore, 
25 comparator 7 and/or output unit 8 need not necessarily be included in diagnostic device 6, but 
may also be installed at some other location in the vehicle. 

Finally, the present invention is not limited to the number of control units 2 or sensors 3 to 5 
shown in Figures 1 and 3, but may be expanded to any number of such devices 2 to 5. 
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Abstract Of The Disclosure 
The present inv e ntion arrangement provides a method for monitoring the performance 
reliability of a control unit and/or at least one sensor of a safety device for the protection of 
vehicle occupants, comprising the steps that a negative acceleration or velocity caused by an 
5 impact, in particular, be recorded; a value for the impact severity be derived from the recorded 
acceleration or velocity; and the value for the impact severity be compared to a predefined 
threshold value. If the value for the impact severity exceeds the predefined threshold value, an 
error-function signal will be output, which indicates that the proper functioning can no longer 
be ensured for the control unit and/or for at least one sensor. The present mv e ntion arrangement 
10 also relates to a diagnostic device for such a method. 

(Figure 2) 
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